GovOPlaN/govoplan-search
2
0
Fork 0
Code Issues 2 Pull Requests Actions Packages Projects Releases Wiki Activity

Complete permission-aware native search indexing

Browse Source
This commit is contained in:
zemion
2026-08-04 03:05:03 +02:00
parent 912db10a8a
commit 1bb338117f
12 changed files with 680 additions and 26 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+19 -7
View File
@@ -6,6 +6,9 @@
Permission-aware global and contextual search for GovOPlaN.
The route, overlay, state, accessibility, and consequence mapping is recorded in
[`docs/INTERFACE_PATTERN_MIGRATION.md`](docs/INTERFACE_PATTERN_MIGRATION.md).
The module works with its built-in database index and no external search
service. PostgreSQL uses native full-text search; SQLite provides a bounded
development fallback. Other modules may:
@@ -22,17 +25,26 @@ Source modules remain responsible for defining visibility and authorization.
Source modules register a versioned `search_sources` provider. A provider
declares its resource types and index version, returns bounded resumable
backfill pages, and batch-rechecks current authorization for sensitive
resources. Incremental writes use `SearchIndexChange` and
`search.index_writer.enqueue_change()` so change IDs are durable and
idempotent in the same database transaction as the caller.
resources. A source may additionally implement the event-source extension to
translate committed platform events into `SearchIndexChange` records. The
platform event worker queues those records idempotently and applies them to the
derived index; Search never imports a source module or invents its ACL. Direct
capability callers may still use `search.index_writer.enqueue_change()` when
they already own a suitable transactional boundary.
The built-in backend exposes opaque cursor pagination and does not return
pre-authorization totals. PostgreSQL uses full-text search and will add
trigram indexes when `pg_trgm` is already installed; SQLite remains a bounded
development fallback.
Tenant search administrators can inspect `/api/v1/search/admin/diagnostics`,
Tenant search administrators can use **Administration > Search index** or the
equivalent `/api/v1/search/admin/*` endpoints to inspect source coverage,
reconcile disabled modules, process queued changes, and start or continue
resumable provider rebuilds. Rows requiring a source authorization recheck
are omitted when their provider is unavailable, stale, or fails to return an
explicit allow decision.
bounded provider rebuilds. Quarantined changes and provider errors stay
visible. Rows requiring a source authorization recheck are omitted when their
provider is unavailable, stale, or fails to return an explicit allow decision.
Files, Campaign, Calendar, Mail, IDM, and Postbox provide native source
adapters. Mail indexes only its bounded read-only cache, and Postbox never
indexes ciphertext or key material. All six recheck current source-owned
authorization when results are returned.